Analysis
-
max time kernel
149s -
max time network
191s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
02-10-2021 03:25
Static task
static1
Behavioral task
behavioral1
Sample
6a5f6fba52919a8f6f8e371284c3458b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
6a5f6fba52919a8f6f8e371284c3458b.exe
Resource
win10-en-20210920
General
-
Target
6a5f6fba52919a8f6f8e371284c3458b.exe
-
Size
104KB
-
MD5
6a5f6fba52919a8f6f8e371284c3458b
-
SHA1
669cba3048a250fdb53c4a708ae7b92006072942
-
SHA256
bd5fa7ccde2dbc145685b36d66c3c6161e7e780308bd6ec29666139908e7db26
-
SHA512
5bb20db97e23e93a1c4a6e54bc0b13973012e04d71f4b3efd3e5e1ba691fb0d86a6fbd758446ceab7827be9cb790998d432ed4150d6ddbfdf17b7f8314386e13
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
paomarca.duckdns.org:2054
fede6f9724
-
reg_key
fede6f9724
-
splitter
@!#&^%$
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
Processes:
resource yara_rule behavioral1/memory/628-62-0x0000000000670000-0x000000000068D000-memory.dmp Core1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6a5f6fba52919a8f6f8e371284c3458b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\file.exe = "C:\\Users\\Admin\\AppData\\Local\\file.exe" 6a5f6fba52919a8f6f8e371284c3458b.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
6a5f6fba52919a8f6f8e371284c3458b.exedescription pid process Token: SeDebugPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 628 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 628 6a5f6fba52919a8f6f8e371284c3458b.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-59-0x000000013FD80000-0x000000013FD81000-memory.dmpFilesize
4KB
-
memory/628-61-0x0000000000640000-0x0000000000667000-memory.dmpFilesize
156KB
-
memory/628-62-0x0000000000670000-0x000000000068D000-memory.dmpFilesize
116KB
-
memory/628-63-0x00000000022B0000-0x00000000022B2000-memory.dmpFilesize
8KB
-
memory/628-64-0x0000000000830000-0x0000000000838000-memory.dmpFilesize
32KB